Privacy Policy

1. Scope and principles

This Policy explains how RigorMed handles personal information when providing its website, accounts, and medical research assistance service, and how you can exercise your rights. We aim to use information for clear, necessary purposes and to be transparent about that use. Using the service is not consent to unrelated processing. We will separately notify you and obtain any legally required separate consent before such processing.

2. Information we collect

Project files and conversations may contain personal or sensitive information you choose to submit. Submit only what is necessary for your research task and confirm that you have a lawful basis to process it. Uploading a file does not mean that we assume you obtained permission from everyone mentioned in it.

• Account data: WeChat OpenID and sign-in or follow events, account state, and any email address or phone number you later bind.
• Project and interaction data: task descriptions, conversations, feedback, file indexes, and project content needed to complete a task.
• Device and log data: access times, IP address, browser and device type, request and error logs, and security events.
• Transaction data: orders, memberships, credits, payment and reconciliation status. The payment provider may process payment credentials directly.
• Support data: contact details and correspondence you provide when asking for help or reporting a problem.

3. Purposes and lawful bases

We use information as necessary to create and manage accounts; deliver projects, conversations, files, research assistance, and paid benefits; carry out requested tasks and preserve progress and results; protect security, detect abuse, resolve faults, and respond to support; and handle orders, billing, reconciliation, tax, audit, and regulatory duties.

Processing may rely on performing our agreement with you, your consent, our legal obligations, or another basis permitted by law. We do not use project files or conversations for unrelated targeted advertising. If an important purpose, method, or category changes, we will provide a new notice and seek consent where required.

4. Cookies and local storage

We may use cookies, browser storage, or similar technologies to maintain sign-in sessions, save necessary preferences, protect the service, and improve performance. You can manage these in your browser, but disabling essential storage may prevent sign-in or some features from working.

We use Google Analytics 4 (GA4) and its cookies to automatically measure page visits and traffic sources across the site, including the signed-in workspace. Google receives page URLs, referring pages, and source parameters such as UTM; other URL parameters may also be collected. Google Signals and ads personalisation remain disabled.

We do not add conversation text, uploaded file contents, or sign-in credentials to GA4 analytics events. Do not put personal information or sensitive patient data in URL parameters.

5. Providers, sharing, and international transfers

We do not sell personal information. Necessary providers may handle information for WeChat sign-in, cloud storage, model processing, payments, notifications, security, and operations under contractual and access controls. When you choose a model or submit a task, the instructions, relevant file content or excerpts, and necessary technical identifiers may be sent to its model or tool provider. Payment providers handle necessary transaction details; cloud providers store and transmit files. Our use of providers does not remove our responsibilities under applicable privacy law.

We do not otherwise provide personal information to third parties unless you separately consent, we must meet a legal obligation, or law permits it. If information transfers in a merger or asset transaction, we will give the notice required by law and require the recipient to respect this Policy. Before an international transfer that requires notice or a separate consent, we will explain the overseas recipient, purpose, method, categories, and how to exercise your rights, and complete any applicable legal procedure.

6. Storage and retention

We keep personal information only for the shortest period needed for the stated purposes, unless law, a dispute, transaction reconciliation, or a security audit requires longer. After the applicable period, we delete or anonymize it as required by law.

When you delete a project file, it immediately becomes unavailable through the product; the stored object and file index are normally cleaned up after seven days. A file linked to a formal research-artifact audit trail may need to remain to preserve provenance; statutory retention also applies. Orders, payments, refunds, invoices, and necessary security logs may be kept longer for reconciliation, tax, disputes, or legal duties, but we do not keep every account data category indefinitely merely because it belongs to one account.

7. Security

We use reasonable controls such as access restrictions, transmission protection, least privilege, audit logs, and security monitoring. No internet service can guarantee absolute security. If a personal-information incident may affect your rights, we will take remedial steps and give any notices or reports required by law.

8. Your rights

Subject to applicable law, you may ask to access, copy, correct, supplement, or delete your personal information; withdraw consent-based permission; close your account; or receive an explanation of our processing rules. We may verify your identity before acting to protect account and data security. Withdrawal does not invalidate processing already carried out with your consent or processing required on another lawful basis.

Use the available product controls to manage projects and files, or contact us at the address below to make a rights request or complaint. We will respond within the time required by law after verification and explain any refusal and available remedies.

9. Children

RigorMed is intended for research professionals and organisations, not primarily for minors. Minors should use the service only with a guardian’s consent and guidance. If you believe we collected a minor’s information unknowingly, contact us so we can address it.

10. Changes to this Policy

We may update this Policy when the service or law changes. We will publish changes on this page and give prominent notice, or seek fresh consent when required, for material changes to processing purposes, methods, categories, or your rights.

11. Contact

For a privacy-rights request, question, or complaint, contact us using the email address below. We will verify and handle your request within the time required by law.